topic Re: syslog.log staying empty in Operating System - HP-UX

syslog.log staying empty

Randy Brown_1 — Wed, 23 Jul 2003 13:29:18 GMT

I noticed this morning that /var/adm/syslog/syslog.log is 0 bytes. The machine was rebooted this morning and I did not notice anything during the reboot that would point me to anything being wrong. I have looked through rc.log and don't see anything there either. A ps -ef |grep syslog shows that syslogd is running. Things have been fine until the reboot this morning. Even using logger doesn't put entried in the syslog.log file. Any thoughts? I will gladly provide more info as needed.

Thank you,

Randy

Re: syslog.log staying empty

Patrick Wallek — Wed, 23 Jul 2003 13:30:48 GMT

Check your /etc/syslog.conf file and see if perhaps someone made a change and are now writing things to a file other than /var/adm/syslog/syslog.log.

Re: syslog.log staying empty

Steven E. Protter — Wed, 23 Jul 2003 13:31:35 GMT

What are the permissions on the file /var/adm/syslog/syslog.log

check /etc/rc.config.d/syslogd for anything unusual.

Don't make a backup copy in /etc/rc.config.d it will mess things up.

SEP

Re: syslog.log staying empty

Pete Randall — Wed, 23 Jul 2003 13:33:05 GMT

Randy,

I think Patrick's probably on the right track, but what about permissions? And, does OLDsyslog.log contain anything?

Pete

Re: syslog.log staying empty

Chris Wilshaw — Wed, 23 Jul 2003 13:33:52 GMT

You could try to use

kill -HUP

on the syslogd process - this should force it to re-read the config file.

Also, you should confirm that you have free space in /var

Re: syslog.log staying empty

Massimo Bianchi — Wed, 23 Jul 2003 13:34:38 GMT

Hi,
my working /etc/syslog.conf:

# @(#) $Revision: 74.1 $
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *

To have the system re-read it,
just issue

To make syslogd, re-read its configuration file, send it a HANGUP
signal:

kill -HUP `cat /var/run/syslog.pid`

Massimo

Re: syslog.log staying empty

Hai Nguyen_1 — Wed, 23 Jul 2003 13:36:19 GMT

Randy,

Check the content of /etc/syslog.conf to see if it has been modified.

Hai

Re: syslog.log staying empty

Jeff Schussele — Wed, 23 Jul 2003 13:40:27 GMT

Hi Randy,

Sounds like syslogd is hung. You need to determine the PID
ps -ef | grep syslog
Then kill -HUP it
kill -HUP XXXX #where XXXX=syslogd_PID

If a new ps -ef | grep syslog does not show a new PID, then kill XXXX & run
/usr/sbin/syslogd -D
to restart it.

HTH,
Jeff

Re: syslog.log staying empty

David_246 — Wed, 23 Jul 2003 13:46:22 GMT

Hi Randy,

Sometimes it's a problem with you file in use as well (corrupt).
- Stop syslog
- mv your current syslog.log file
- touch a new one.
- and start sylogd

It should work fine now. kill -HUP should give you some extra data in you syslog.log, also of course the program logger should add some lines in there.
Make sure your syslog.conf has all permissions and does not conatain any weird characters.

Regs David

Re: syslog.log staying empty

Jeff Schussele — Wed, 23 Jul 2003 13:46:51 GMT

There's a way to test whether syslogd is hung.
Enter the following command

logger "This is a test log entry"

Then check the syslog.log file. If it doesn't appear then syslogd is definitely hung & you'll have to bounce it.

Also I'd check /etc/rc.log to see if S220syslogd had trouble starting in run-level 2.

HTH,
Jeff

Re: syslog.log staying empty

Randy Brown_1 — Wed, 23 Jul 2003 13:49:01 GMT

Thank for all of the responses.

Here is some more info:

-rw-r--r-- 1 root sys 0 Jul 23 07:54 syslog.log

-rw-r--r-- 1 root sys 0 Jul 23 07:46 OLDsyslog.log

# @(#) $Revision: 74.1 $
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *

#Log to a log host too. BSM - 10/2/00
*.info @watcher

The file system has space on it (plenty). I did just find tabs in the last entry of the syslog.conf file. I removed them and stopped and started syslogd but still have 0 bytes in syslog.log

Re: syslog.log staying empty

Hai Nguyen_1 — Wed, 23 Jul 2003 13:57:10 GMT

Randy,

Can you post the output of this command:

# ll /dev/klog /dev/log /dev/log.un

Hai

Re: syslog.log staying empty

Randy Brown_1 — Wed, 23 Jul 2003 14:04:03 GMT

No problems in rc.log either

Start system message logging daemon
Output from "/sbin/rc2.d/S220syslogd start":
----------------------------
System message logger started

This is stumping me completely. I moved the syslog.log file and touched a new one too and still nothing. Hmmmmm.

Re: syslog.log staying empty

Randy Brown_1 — Wed, 23 Jul 2003 14:10:38 GMT

[clifford_root]$ll /dev/klog /dev/log /dev/log.un
/dev/log.un not found
crw------- 1 bin bin 189 0x000000 Aug 2 1999 /dev/klog
prw-rw-rw- 1 root root 0 Jul 23 11:08 /dev/log

Re: syslog.log staying empty

Hai Nguyen_1 — Wed, 23 Jul 2003 14:17:14 GMT

Randy,

jabs-hpl # ll /dev/klog /dev/log /dev/log.un
crw------- 1 bin bin 189 0x000000 Dec 10 1999 /dev/klog
prw-rw-rw- 1 root root 0 Jul 23 11:11 /dev/log
srw-rw-rw- 1 root root 0 Jul 17 14:20 /dev/log.un

Your output should look similar to the above. The missing /dev/log.un is needed (it is a socket file). Let me research on how to recreate it. Then I'll get back to you.

Hai

Re: syslog.log staying empty

Hai Nguyen_1 — Wed, 23 Jul 2003 14:25:41 GMT

Randy,

Can you try this:

# echo "this is a test" > /dev/log
# cat /var/adm/syslog/syslog.log

You should see the line "this is a test" in the syslog.log.

Hai

Re: syslog.log staying empty

John Payne_2 — Wed, 23 Jul 2003 16:49:10 GMT

Is /var full? (Or /var/adm/syslog/syslog.log's filesystem, if you changed it.)

Your configuration looks ok.

Hope it helps

John

Re: syslog.log staying empty

Randy Brown_1 — Wed, 23 Jul 2003 16:56:00 GMT

There's plenty of room on the file system. Is there somewhere other than rc.log I can look for errors recorded during boot up?

Randy

Re: syslog.log staying empty

Wouter Jagers — Wed, 23 Jul 2003 17:58:00 GMT

issue 'dmesg'

regards
Wout

Re: syslog.log staying empty

D. Jackson_1 — Wed, 23 Jul 2003 21:10:22 GMT

Just a stab, but is "watcher" on the network, can it be seen by this system?

Just a thought.
GL